fsociety
A Claude Code plugin of offensive security skills, agents and commands for penetration testers. It covers API testing, network reconnaissance, cloud lateral movement, password attacks and payment security.

A Claude Code plugin of offensive security skills, agents and commands for penetration testers. It covers API testing, network reconnaissance, cloud lateral movement, password attacks and payment security.
This skill should be used when the user mentions "log cleaning", "clear logs", "wipe logs", "timestomp", "timestamp…
Activate this skill whenever the user mentions API endpoint, REST API, RESTful, GraphQL, GraphQL introspection, GraphQL mutation,…
This skill activates when the user mentions "patch analysis", "binary diff", "binary diffing", "bindiff", "BinDiff", "Diaphora",…
Activate this skill whenever the user mentions cloud lateral movement, cloud privilege escalation, cloud post-exploitation, cloud…
This skill should be used when the user mentions "handoff to elliot", "pipeline to elliot", "cross-plugin", "elliot handoff",…
This skill should be used when the user mentions "dump database", "acquire data", "download dump", "extract records",…
Activate this skill when the user mentions ".NET", "CLR", "managed code", "C# binary", "C# decompile", "decompile C#", "VB.NET",…
This skill should be used when the user mentions "new engagement", "setup engagement", "initialize workspace", "start operation",…
This skill should be used when the user mentions "Shodan", "Censys", "MongoDB exposed", "Elasticsearch open", "Redis no auth",…
This skill should be used when the user mentions "hunt leaks", "find breaches", "credential leaks", "data leak", "breach…
Activate this skill when the user mentions ANY of: "YARA", "YARA rules", "YARA signature", "write YARA", "detection rule",…
Network anonymity and traffic concealment for red team operations. Use this skill whenever the user mentions "proxy chain",…
Use this agent when the user asks to "reverse engineer a binary", "analyze an executable", "disassemble this file", "decompile a…
Use this agent when the user asks to "clean up traces", "remove evidence", "wipe logs", "eliminate footprint", "clean the…
Use this agent when the user asks to "exploit a vulnerability", "test this exploit", "generate exploit", "attack this endpoint",…
Use this agent when the user asks to "secure a machine", "harden a server", "make a system secure", "set up opsec", "prepare…
Use this agent when the user asks to "hunt for leaks", "find exposed databases", "search for breaches", "discover leak sources",…
Use this agent when the user asks to "acquire leak data", "dump this database", "extract and pipeline", "download the data",…
Use this agent when the user asks to "run recon", "enumerate a target", "do reconnaissance", "scan subdomains", "map the attack…
Full static analysis workflow — PE headers, strings, disassembly, classification
API security audit — REST, GraphQL, JWT analysis, parameter discovery
Password brute force and hash cracking against target services
Resume or execute an attack campaign with progress tracking
Malware classification — YARA scanning, entropy analysis, packer detection
Show running scans, system health, and engagement status
Post-engagement lessons learned analysis and debrief report
Ghidra headless decompilation with function analysis
Binary diffing — compare two binaries for patch analysis
Directory and content discovery with recursive crawling
.NET assembly analysis — decompilation, deobfuscation, metadata extraction
Is this you? Claim your profilePut a plugin at the top of Plugins, from $9